3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
Size 9.0MB
Sample261102-x1swmsgb67
SHA256 3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948
MD5 23d03ef5f67cee539c0fe5d425c8700e
SHA1 bb792221e6019ad67de3d88f50db4df8eb55aa47
SHA512 c2eba638f633b585624be778d9a6b482b10eed6d23e9cb3c3ac5cd1a7d3d6212b29bc6d783c96f97b73ea022e9ee8ab65117b4c15b7ca2ddd7630c04c45f520a
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWlfG3WDnorYJmy6h:TDpbgBr/4QAMQaTCvkA3BWl8WDo0J36h
TLSH
T1239633D6786E5ABBD11E1C3ECD1ADD2231AC17B187505DD3EFD53AB78840D920A32E22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5064	SystemTrayHelper.exe

Executes dropped EXE 10 IoCs

pid	Process
5064	SystemTrayHelper.exe
2616	SystemTrayHelper.exe
2440	UpdateService.exe
3680	UpdateService.exe
2164	UpdateService.exe
5416	UpdateService.exe
1388	SecurityCore.exe
3184	SecurityCore.exe
2420	SecurityCore.exe
2084	SecurityCore.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\\\SystemTrayHelper.exe\""	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	SystemTrayHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemMonitor\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search\\UpdateService.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\CLR_v4.0\\SecurityCore.exe\""	UpdateService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSystemMonitor = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportQueue\\SecurityCore.exe\""	SecurityCore.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
13	raw.githubusercontent.com
25	raw.githubusercontent.com
35	raw.githubusercontent.com
39	raw.githubusercontent.com
46	raw.githubusercontent.com
57	raw.githubusercontent.com
70	raw.githubusercontent.com

Detect suspicious telegram bot 5 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/files/0x000c00000001c5f0-27.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5f1-99.dat	suspicious_telegram_bot
behavioral2/files/0x000c00000001c5f5-133.dat	suspicious_telegram_bot
behavioral2/files/0x000d00000001c5f6-155.dat	suspicious_telegram_bot
behavioral2/files/0x0004000000016af5-160.dat	suspicious_telegram_bot

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SystemTrayHelper.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UpdateService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityCore.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemTrayHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdateService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecurityCore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
2616	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
2616	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
5064	SystemTrayHelper.exe
2440	UpdateService.exe
2440	UpdateService.exe
2440	UpdateService.exe
2440	UpdateService.exe
3680	UpdateService.exe
3680	UpdateService.exe
3680	UpdateService.exe
3680	UpdateService.exe
3680	UpdateService.exe
3680	UpdateService.exe
3680	UpdateService.exe
3680	UpdateService.exe
2164	UpdateService.exe
2164	UpdateService.exe
2164	UpdateService.exe
2164	UpdateService.exe
5416	UpdateService.exe
5416	UpdateService.exe
5416	UpdateService.exe
5416	UpdateService.exe
5416	UpdateService.exe
5416	UpdateService.exe
5416	UpdateService.exe
5416	UpdateService.exe
3184	SecurityCore.exe
3184	SecurityCore.exe
1388	SecurityCore.exe
1388	SecurityCore.exe
3184	SecurityCore.exe
3184	SecurityCore.exe
1388	SecurityCore.exe
1388	SecurityCore.exe
1388	SecurityCore.exe
1388	SecurityCore.exe
1388	SecurityCore.exe
1388	SecurityCore.exe
2420	SecurityCore.exe
2420	SecurityCore.exe
2084	SecurityCore.exe
2084	SecurityCore.exe
2084	SecurityCore.exe
2084	SecurityCore.exe
2084	SecurityCore.exe
2084	SecurityCore.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2616	4188	3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe	90
PID 5064 wrote to memory of 2440	5064	SystemTrayHelper.exe	91
PID 3680 wrote to memory of 2164	3680	UpdateService.exe	95
PID 5416 wrote to memory of 3184	5416	UpdateService.exe	100
PID 1388 wrote to memory of 2084	1388	SecurityCore.exe	103

C:\Users\Admin\AppData\Local\Temp\3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe
"C:\Users\Admin\AppData\Local\Temp\3bd9863d635cd3ea155aefd4db81380b5902a81c630afd9f89025094c2c42948.exe"
1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2616

C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
"C:\Users\Admin\AppData\Local\Temp\\SystemTrayHelper.exe"
1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2440

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
"C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3184

C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe" --monitor
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2084

C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe"
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09A184963DB18218E7969055927ED546
Size 279B
SHA256 30bf9e443363caee061b86be58112778c9f3dcde80c66ac4c60fdf8c866af235
MD5 a90d7875e1ec040d2d0aa4b0e074148a
SHA1 ec3e12073d26b59d7c6fc28ab4301072c5183c17
SHA512 ae6dbbe08bfce63f9f40d5194268820f6b5bdbb19ebdf80bb1de9c9f0fa7657df09bd231b3d0615e42083584b7b38fdedd5478e19620ef0eb4804a21967d265b
TLSH
T1EAD02B0AA5EE2C553C72DE60D4E4A4887110B465B6E86829D58AC796290DE3F3E11A04
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 65cc31e83cd11721336228a00a70c171ef4c49a10eab5f13f1a7bc5a739be077
MD5 8bffcfe25e10299937aa756bac07081d
SHA1 3c0a4c43cae6c30c330cbdc508b5b1fc3cac85f5
SHA512 ffda407675728466210823178affd8b5e297a5525a3ca7994d15b73b72c3fa68749522c7733e300e3277d61b71bc5ef10de0ad7a89b6067b83069844d713df42
TLSH
T116E0E75ED31CE2A036224A342F919D173890414F04C7D14F38360BCCCD43317580309D
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 eeba956cfcf0d69218d0e0e411247bde9cca90e1a03b17f796d3e129c85ac7d3
MD5 ec11c6190ca3cd488ef9c937d21ca6ca
SHA1 e49047b77feb9efeb5e959e2b954bff0d22b2596
SHA512 2e10ef6aeb1edf5b73c405b3a3d711e288efbdcef2ab162bc32beb976190465be2ef243ef89fe5bb99ac985736c5b95a13ae72cf998bb5b390462733a9f2ff05
TLSH
T17441F8DEAF2C7014BF82CFC55578C6322FBCB1D08585544935FA89B27459BE00E0E45C
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\56E83C5857C173AD065FC47EB887B239
Size 201KB
SHA256 8afeaf847de5a7e2ea7690aa6860cd81a76f705194eea80708efe2095049c1c0
MD5 38e3c4d676f5472b8454d43a8295ace0
SHA1 39c32cbb54547ee518cf2719d12932cbce7fe2e3
SHA512 7ee0a0b2a3777750da6d971bd76df2831d66202ccc48ce9a14ad41bef00dfdc806f47eee985c8977af905cd6c22a147a44e25005a771e789ede35ff074dbae56
SSDEEP 3072:Nd1U8bhuuWSVvT8nbJQFY7eRuyYHem19Um+XzezZJpUVOd+V/:Nk2huuWSZ8bisHemTKCjUJ
TLSH
T19E141C286DBBB1619E4A8DA24CD66A5E43F171DF2312630B4EF76ED01D43ADB8E4344C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 975B
SHA256 22917f0998a115ad62abcf80585186d3491654ffe8e03750561436cac45be474
MD5 c4ea55d9f04e6c71387ef4c2f803dd6d
SHA1 df144e5e2c9c5e7d93b054b730e7c362298c0a93
SHA512 7d99ebf7275534600304bebe59a73f31fda1cbb27dc745c82c7c4f26b771019ae7859059bec6c14c89c8745d0764bd42d86152c31eb5581b467711c05dfcc5d8
TLSH
T10911E182DFF4F0C08AE75670DAE8C5767D7560C61EEBB4D12CA1C8D6205A76E2B0802F
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 2KB
SHA256 84a2b3e262f27d54ebd9d19edc41753d1c232e6c6ba8905d14ddd3810945c2d8
MD5 e35f6273465a37e6177bdeaa464a27ba
SHA1 b0ac2e0751abe3e578a468731fa7a746f4279f6a
SHA512 ce9a68e2d60790d28daafe6ed0b8fa3238bf88acd2537fefa25f0512f0dac6ce522cedbcbc547b60d29ab507a9cd69a9a428da126b8a1a08113c9edfaa65c4a4
TLSH
T19A41D8D7AB1E78ACBE01CFCA7DB8C5395E78C0A491C0199071F7C49204EEBD62D0A94C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

09A184963DB18218E7969055927ED546

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09A184963DB18218E7969055927ED546
Size 484B
SHA256 c7c86b060cfa971f47dea0eb0017e4206a21c4feadc9e216c1b703d6d31eef4d
MD5 e2edeb19818d6e0b8869f650826d14f1
SHA1 332707aba4241977f62d0db199980c9260472ff4
SHA512 054c09653448f021538fc9eca3f64bd534726ce0b8c0b473b0de4b70a6003bf083312a5cc704a2f0fb25504593e2e53e3b3457713f5be3d37516020480c75e1f
TLSH
T100F0A358107E420DE035D97582DD75DA5C2AF105340D57FB33D916069725D419E4552E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 83dba41fb598041962ab8a2ff5479e7eb4b0a87c3c9f8324a8bb04781f6c7a12
MD5 ea9ba96178a8014a9dbb885bb8299903
SHA1 df2cc449f2a3ccbb97a151949b198033ef256275
SHA512 24dd5ca9b8436d73e9af41d2d089496faa0f2c95867b9ebd1fe969f6440e8634fbad4b49bc7e6d0fbc92e23dddc7704a3925655a773dd1d1d09d65cd9397a069
TLSH
T1A0C08C1C1AA20A06F2E8437C02C139039B208101F6458F051BF12A08CD96B162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 ab1f8f06c0a0429e21099d821384a9fd8b3f9f3300a63f9ba1e117a9c5de7ed0
MD5 4afba41f9cdd8f6a0cc9d75b8d8c29a5
SHA1 02ab8e8336029e2b6f0e697e671ba9c863f3c103
SHA512 3d061055a86fe7a67bc568b17cab0a080300cdf177167517cdec6c65ef547252a97af2ffcf0790116fa6b5f4c550183221200ba3ecb833dedf85a2ce37fc3249
TLSH
T117F05C2C1BFC906DE036DEBD9BC9B2D35D25F223380459EC2B919B489906F001C51438
MD5 SHA1 SHA512 TLSH

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 7563d0d46384825aa82ed82cefe3dceefb2f5e8345959661c681affaadee91a5
MD5 5ac3f3fbcd64d703f60698557203802e
SHA1 8a523e964cfdb2c7ca0bbd75cae91601cc6c2b01
SHA512 c4ce1f93f92c5daf6be6175691875130d7e47a1c706ed569f9e0f1aa28528812b21375cdffdce03e3e7d7653433605c982fb2bf7c7affd76fcc816dd7fd7852e
TLSH
T112F092643DFADA3BF427DAB903E524B1962AF226740562BD3AA117082A28E506C5251D
MD5 SHA1 SHA512 TLSH

Submit Download

56E83C5857C173AD065FC47EB887B239

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\56E83C5857C173AD065FC47EB887B239
Size 246B
SHA256 24797f982a97b67d1025606ffffd2d05730ea4ba7b854756d9bafafcd0e0d58a
MD5 fb818b81d6af5d47b4933876e1e82170
SHA1 39097dc88443b76f29ff49daf0ffc7b1a93c807d
SHA512 085a369b1a6f2331e29b5896914f0e4086e2a52b626b58212c16f9c6c3bac978586a441aba481d856a897c789e73e5eb0ef2e999dc462bcc0afb9364ff0619d8
TLSH
T10FD0221D47EA1223FDAC623EAAB5098089D1E013B492BF1D0FB33219C81EE430C60D0C
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 ef4c98a7c9d425652804dfcf9131721a623a014603dde875ec80cb75a543a471
MD5 558cd3b1b5f95ebfcac1f0794e7932c5
SHA1 5e30ec45ab50f10f7e462d3414971e1e320220ea
SHA512 8c842a71497ff8f621b87690456725399145de55a21a58fbf0b5daa701e5df40ef3a307bdecf5ff3af6adc885c81d1dffd2e4d2c4b3dfb8c8af980df2579fe59
TLSH
T103F05C2816E2402DF675577541F5A2DA8C2DB3573C00CC6D2ED2530AFA06F005D12579
MD5 SHA1 SHA512 TLSH

Submit Download

DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DF2B6F1E6BCC61CEBCA21A02089A3B19_4F548F7827F125ACC54E53397A41333A
Size 474B
SHA256 1d6e55fd46122e5798722aac054df2ff8676118170948c3f4e9542715bbbfdf4
MD5 780f0a10bc76ff2735dd67a6a1cb2037
SHA1 3d64f1ae457b3b984f66b2f84677ccd0f7fb48cd
SHA512 f2faaafdf421f092bffe7025c489ba1056182284075d5e3279cf29ce9f55091f2dd9201151d70422b489e171f50d3ed2faf0e687138348b65a6bb8a649f62ae5
TLSH
T1BDF02B3624FF011EF677D67903C511DE8123F23A315A27696A60431D5E1594079E1915
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 c4e519f9359c3bc2bcabc4e5c4c013f926c929e3b2f9cddb5f340da087abe780
MD5 0833bdd92bd5c863abc9708e8adad005
SHA1 df79b4a09e3ffc1257a4c7c819b656dbd2f20d0e
SHA512 bbe6463d4e63d5ded0541c620f795f730b38e5552409dde752e5eb3a2543d17f1342e4fe92dd017d6343b3f3d220fadcb4e024d5c57d403c24c27581b95c25b3
TLSH
T192C08C1C0A620616F2E883B812CA2D838B208110F7819F0126B16A48CD24F122834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SecurityCore.exe
Size 9.5MB
SHA256 cc0fd7c95a66ad0c3d448c713b2187ea32a99013dacb31f5ff7f7b26bb5d8941
MD5 0661a99c4f917bc09aa0b09e7dc3fc44
SHA1 247d46777105dae4aeffc399c329697c5ef55c90
SHA512 58310703fe9a162e9dcd9d4e26ddddac6c6b5b03d25f81cbcc0011ab6602c1a507b523a19d3a61f3836746ae04fe2546be3c0b532fa7122c299e68225a58acae
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWlfG3WDnorYJmy6+:TDpbgBr/4QAMQaTCvkA3BWl8WDo0J36+
TLSH
T1AEA633D6786E4ABBD11D1C3ECD5ADD6231AC17B187505DD3EFC93AB78800D920A32E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search\UpdateService.exe
Size 9.3MB
SHA256 69ff3b9c54da66aab8f77fa8bd2905d2699741865f6685606a6d93e148ddf4df
MD5 14388ab5250d3fdafc2fbcd7f0737c68
SHA1 8f43cf1d6dd0bece260667bf2b78e36078a60571
SHA512 34eff73a1c94ee47f5d7a26b84cc5ad23127dfdc75bd978c85bed458e3d86ed8abfb66d557f6767085d8bf459ad86de5a4e13f509ef79c7b8b4f7e3ae57f56f4
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWlfG3WDnorYJmy6R:TDpbgBr/4QAMQaTCvkA3BWl8WDo0J36R
TLSH
T1A2A633D6786E4ABBD11E1C3ECD5ADD6231AC17B187505DD3EFC53AB78800D920A32E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemTrayHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemTrayHelper.exe
Size 9.1MB
SHA256 5bd6d7dab896947f62b60a175efac917348c6f1f6ea12cc346f344b38c8841a7
MD5 ba14e80e4a421af67c62256cc218afb9
SHA1 a7313fa0a71a7241c211013886b6f46bb5d9af03
SHA512 f4e704c7d71d2c8cc1bfaa4384deb88c06f5b8410ee305b87fe4633581fbcf37e34b01700909cef3b92385537e54410ffdbf6e11dec59f906d299ca208322e1d
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWlfG3WDnorYJmy6n:TDpbgBr/4QAMQaTCvkA3BWl8WDo0J36n
TLSH
T143A633D6786E5ABBD11E1C3ECD5A9D2231AC17B187505DD3EFC53AF78800D920A32E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityCore.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\CLR_v4.0\SecurityCore.exe
Size 9.4MB
SHA256 74f4c71b65bc00d47ecb39aafec83ece3a178ca420bcd97706d5e64001e9417c
MD5 b2d0704f87ac819c25953429606d1ab4
SHA1 ab5b4d7ff6bdc58c860e7f12e66b9523c2982fb9
SHA512 c797ef97db5f97307e114b3c95c448660e00559fc90af574505262e7177e92a55217fb4b3340002e61db165639ec854287d6fb814b06dc40ce734e5a914e9254
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWlfG3WDnorYJmy6g:TDpbgBr/4QAMQaTCvkA3BWl8WDo0J36g
TLSH
T1ACA633D6786D5ABBD11D1C3ECD1ADD6231AC17B287505DD3EFC93AB78800D920A32E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemMonitor\UpdateService.exe
Size 9.2MB
SHA256 fec6ff36b2f81bb84ece97ff16bcd30684fa9cc83cc0534b6ffbb5c9b06056e8
MD5 1b48fdb99aa710aa2d12e606c4327b29
SHA1 64a8ea01ab675c248d1fa1e212a5661105ac4f9e
SHA512 3a4d8eb4aab4a5afb2f53c035958065fda34ebcdebe1f9e46ffd460d7ec2834528d2a9b25b27bae4846482f07a7be6395f2afeb8f2a65950a32bec978ce97edb
SSDEEP 196608:+0s420bTjzGlBrJTJb8QAMQai4SGyvkA3AtMWlfG3WDnorYJmy6y:TDpbgBr/4QAMQaTCvkA3BWl8WDo0J36y
TLSH
T155A633D6786E4ABBD11E1C3ECD5ADD6231AC17B187505DD3EFC53AB78800D920A32E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download